-- Bell runtime may read controlled identity bindings, append events/source
-- receipts and maintain only short-lived nonce receipts.

REVOKE ALL ON TABLE bell.event_ingress_bindings,
    bell.event_ingress_receipts, bell.event_ingress_nonces FROM PUBLIC;
REVOKE ALL ON TABLE bell.event_ingress_bindings,
    bell.event_ingress_receipts, bell.event_ingress_nonces FROM bell_runtime;

GRANT SELECT ON TABLE bell.event_ingress_bindings TO bell_runtime;
GRANT SELECT, INSERT ON TABLE bell.event_ingress_receipts TO bell_runtime;
GRANT SELECT, INSERT, DELETE ON TABLE bell.event_ingress_nonces TO bell_runtime;

-- Column grants deliberately exclude endpoint_ref, credential_ref,
-- profile_token and path_name.
GRANT USAGE ON SCHEMA sense TO bell_runtime;
REVOKE ALL ON TABLE sense.devices FROM bell_runtime;
GRANT SELECT (id, tenant_id, site_id, area_id, modality)
    ON TABLE sense.devices TO bell_runtime;
GRANT SELECT (tenant_id, id, deleted_at)
    ON TABLE bell.sites TO bell_runtime;
GRANT SELECT (tenant_id, site_id, id, capture_policy, deleted_at)
    ON TABLE bell.areas TO bell_runtime;

REVOKE ALL ON TABLE bell.event_ingress_bindings,
    bell.event_ingress_receipts, bell.event_ingress_nonces FROM sense_app;